Solved

PIX 506E problem accessing Internet after hours

Posted on 2006-10-24
11
205 Views
Last Modified: 2010-04-09
I configured PIX 506E restricted device (R-pix-506E-BUN-K9) did not know that Pix 506E has restricted version.
My Story IS!!

I configured the 506E and all users could access the internet and receive and send email as well 2 days ago but yesterday the users could not access the internet.Spoke to ISP and they confirmed that the link was fine. I tested with an old 3com firewall router and it works fine.
I have looked at the fixup and could not find a fixup DNS entry, I tried to put in the command but it won't take it with error " Bad protocol dns".
I am held up hear at this point dont know what has happened.
Any kind of help will be appreciated.
Do i need to activate the Device ?
"Show vers" command shows that its been activated.
My worry is that it worked for some 2 days.
My sample config is below.

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password encrypted
passwd  encrypted
hostname LA-FW
domain-name LA.com
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list acl_in permit tcp any host X.X.182.153 eq smtp
access-list 102 permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside X.X.182.153 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool 10.0.0.100-10.0.0.120
pdm location 192.168.1.5 255.255.255.255 inside
pdm location 10.0.0.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 102
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp X.X.182.153 smtp 192.168.1.5 smtp netmask 255.255
.255.255 0 0
access-group acl_in in interface outside
route outside 0.0.0.0 0.0.0.0 X.X.182.158 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server partnerauth protocol radius
aaa-server partnerauth (inside) host 192.168.1.5 un1v3rs1ty timeout 5
http server enable
http 192.168.1.0 255.255.255.255 inside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt ipsec pl-compatible
crypto ipsec transform-set strongdes esp-3des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set strongdes
crypto map partner-map 10 ipsec-isakmp dynamic dynmap
crypto map partner-map client authentication partnerauth
crypto map partner-map interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 3600
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup LA address-pool ippool
vpngroup LA dns-server 192.168.1.5
vpngroup LA wins-server 192.168.1.5
vpngroup LA idle-time 1800
vpngroup LA password
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:b4c9f4f63ffcbc9faa3d7b07bd678474
: end

Can some one look at my config to identify why this is happening. Basically when I move the connection to a 3com firewall for 30min and connect  back the pix506 it starts working again.
When i do the "show int" command i get the below output.

interface ethernet0 "outside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.bd3c.02eb
  IP address X.X.182.153, subnet mask 255.255.255.248
  MTU 1500 bytes, BW 10000 Kbit half duplex
        304669 packets input, 241369008 bytes, 0 no buffer
        Received 463 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        274255 packets output, 122942548 bytes, 0 underruns
        0 output errors, 4327 collisions, 0 interface resets
        0 babbles, 0 late collisions, 1701 deferred
        1 lost carrier, 0 no carrier
        input queue (curr/max blocks): hardware (128/128) software (0/2)
        output queue (curr/max blocks): hardware (0/26) software (0/3)
interface ethernet1 "inside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.bd3c.02ec
  IP address 192.168.1.1, subnet mask 255.255.255.0
  MTU 1500 bytes, BW 100000 Kbit full duplex
        309339 packets input, 121496564 bytes, 0 no buffer
        Received 31047 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        300447 packets output, 234414434 bytes, 0 underruns
        0 output errors, 0 collisions, 0 interface resets
        0 babbles, 0 late collisions, 0 deferred
        1 lost carrier, 0 no carrier

I changed the cable from the DSL router to a cross cable and it worked for about 12hrs and stopped allowing users access to the internet but all emails work fine.

Can someone HELP PLEASE!!!?
0
Comment
Question by:afamm
  • 5
  • 4
11 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 17796947
>PIX Version 6.3(1)
Does not support dns fixup. You'd have to upgrade to 6.3(5)

There's nothing wrong with the config. If it was a configuration issue it either works or not. If it worked for 12 hours then stops, then it is something else.

Pix is running at half duplex
 MTU 1500 bytes, BW 10000 Kbit half duplex
I see collision counters on the interface, which is expected if both devices are set to half-duplex. Pix is set to auto, and might not be negotiating properly with the DSL router/modem.
What exactly are you connecting the outside interface to? A DSL modem? It could be a duplex mismatch between the DSL and the PIX. You could put a small switch in between them and see if that clears it up.
0
 

Author Comment

by:afamm
ID: 17797032
the outside interface is connected to an SDSL modem and the port says 10baseT.
what kind of switch. Can you give me a sample switch that i couls use please?
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 17797266
0
 

Author Comment

by:afamm
ID: 17797994
The SDSL modem that i have has four 10baset ports and a cross cable connected from one of the SDSL ports to  the Eternet0 pix 506 interface and from the Ethernet1 of the Pix506 a cable connected to a Netgear Gigabite switch GS748T.
I have also gone ahead to change the ethernet0 port command on the Pix to 10baset (ie. interface ethernet0 10baset)and it runnung on a half duplex connection speed.
The netgear is an autosensing switch and does not have a direct conection with the switch.
Please let me know what you think.

Regards,


0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 79

Expert Comment

by:lrmoore
ID: 17798110
If it's a 4-port switch on the back of the DSL modem, then a crossover cable would not be needed. Suggest going back to straight-through cable.
0
 

Author Comment

by:afamm
ID: 17801780
Clients are complaining that they cannot get through to some websites.
Any command that will allow these access please?
0
 

Author Comment

by:afamm
ID: 17802261
Also what command would i use for a half duplex connection on the pix?
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 17802680
interface ethernet0 10baset
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 17830859
Hello???
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now